Engineering Insights
Real problems. Engineering-first thinking. No product pitches. Written for developers, architects, and security engineers who care about what actually leaves their applications.
AI logs can become a second copy of sensitive data. Govern what enters them.
A dated case study of Wiz's January 2025 DeepSeek disclosure, the limits of storage controls, and scoped application logging governance.
Explore effective strategies to prevent credential leaks through smart logging practices and system design.
Explore effective strategies to prevent credential leaks in logs by focusing on classification, centralization, and early scrubbing.
Learn strategies to prevent sensitive data from leaking into logs during system issues.
Exploring why downstream log masking is insufficient and how proactive data control can enhance security.
Learn how to prevent data leaks by controlling sensitive information from the point of creation using structured logging and secure practices.
A reconstructed incident walk-through: how a single token in a debug log spread across six systems before downstream masking caught it - and what should have prevented it.
Most logging defaults are wrong for security. A default-deny model - where only explicitly approved fields are written - changes the risk posture fundamentally.
By the time a SIEM flags a sensitive token, it has already hit stdout, log agents, queues, and backups. Here is how to intercept it at the first write instead.
Structured events with allowlists, unified logging interfaces, ORM configuration, CI guardrails - eight concrete implementation patterns for keeping secrets out of your log pipeline.
Moving log governance inside the application changes your security posture significantly. Here are the design principles, implementation patterns, and tradeoffs to plan for.
API outages create pressure to log everything fast. That is exactly when sensitive tokens, emails, and credentials end up in places you cannot clean up.
Reactive log security treats the symptom. Preemptive logging treats the cause - classifying and intercepting sensitive data before it is ever written.
A structured, step-by-step plan for governing logging in-process - from defining field policies to CI guardrails and runtime safety nets.
Downstream masking seems like the safe choice for log security. Here is why it fails in practice, and what upstream controls actually look like.
Logging more doesn't mean knowing more. Here's what it actually costs.
Over-logging is one of the most common and least-discussed engineering inefficiencies. It inflates bills, degrades signal quality, and creates compliance exposure - often without anyone noticing until it's expensive.
Regex rules and sink filters seem like the right answer. They aren't.
Log redaction pipelines work in small teams and simple systems. Here's what breaks as you add developers, services, and regulatory scope - and why the failure is structural, not operational.
It's a governance problem - and the two require very different solutions.
Most teams treat PII leaking into logs as a configuration issue. It isn't. It's an architectural one. Here's why the standard fixes keep failing, and what actually works.
Review a Scanner finding or logging requirement against your existing controls. If a recurring gap remains, scope one CerbiShield workload, policy, evaluation window, and evidence review.